How to detect the MASQ antidetect browser
MASQ is an antidetect browser: a fake browser that gives each profile the fingerprint of a different device, so one person can run many accounts. Its site, masqad.com, offered "over 5M+ real fingerprints updated daily" and promised to be "minimizing the possibility of detection by anti-fraud systems" (archived site, 2024). Maskbreak's answer does not name the product. It checks what every such session has to fake (the device, the network path and often the hands on the keyboard) and blocks a fake browser by default.
What MASQ is (October 2026)
Two different products have used the name. The antidetect browser people search for was sold at masqad.com from late 2022, for Windows and macOS: a free plan with "5 Browser profiles", paid plans named Light, Pro and Team with a proxy manager, "Autofarming" and team seats, pre-built scripts "to automate repetitive tasks on Facebook, Amazon, and other platforms", and payment in cryptocurrency among other methods. It sold itself for marketplace seller accounts, media buying, affiliate marketing and "Bonushunting" (the same archived site). Its earlier pages listed how it changed a fingerprint: "Mixing random noise in WEBGL function", "Mixing random noise in the CANVAS function", "Modification of audio functions" and "Setting a proxy server for each profile", and in 2022 it pitched working "any number of bookmaker or casino accounts from one device" (archived site, 2023). Its site did not name the engine; a September 2024 review describes it as built on Firefox (Proxy-Seller).
The other MASQ was a fingerprint-spoofing tool sold on the dark web in 2021. Security Affairs, writing up Resecurity's research, described "a new tool available for sale in the Dark Web called MASQ, enabling bad actors to emulate device fingerprints", "available for $130 and each new device fingerprint starts from $1", with "integration with underground proxy services" (Security Affairs, June 2021). Its feature list resembles masqad.com's, but no source we found ties the two together. MASQ Network, a privacy browser with a built-in VPN, is a third product and not an antidetect browser.
Status: masqad.com answered with a server error (HTTP 521) on 26 October 2026, and the Internet Archive's last working copy of its homepage is from 18 October 2025 (archived homepage). We could not confirm that it is still sold anywhere.
How Maskbreak reads a MASQ session
A MASQ session makes three claims: a real device, an ordinary connection and a person at the keyboard. A fingerprint copied from a real device holds together on its own; what gives a profile away is the rest of the session. Maskbreak's device check and network intelligence test those claims separately. A fake browser, a script driving the browser or a proxy exit each blocks on its own by default; a VPN alone is flagged for review.
device.antidetect is true, the reason antidetect_browser is added and the decision is block, the same as for a proxy, Tor, automation or an emulator. It flags the class of tool; it does not say which product the visitor used.device.tampering_score is a 0–1 score from the device check, not a probability of fraud, and it can sit near zero while antidetect is true. Route on decision and reasons; do not build a threshold on the score.device.automation is true, the reason automation_detected is added and the visit is blocked. It does not name the framework; bot detection covers the signal in full.proxy_detected and blocks; a VPN alone adds vpn_detected and goes to review. A residential proxy it does not recognise passes this layer, which is why the device check matters.device.virtual_machine is true and the reason virtual_machine is listed; on its own it asks for review, never a block: plenty of developers browse from one. It raises the risk score next to other findings.device.times_seen counts how often the device appears in Maskbreak's retained history, across all customers, not only yours. Send your own accountId and device.linked_accounts counts how many of your accounts the device has been used for; more than one adds multi_account_device, and three or more of your accounts on one device within 24 hours add device_many_accounts and ask for review. Links stay inside your account, stored as keyed hashes. Profile switchers are built to defeat exactly this, so treat linking as an extra layer, not the main one.An example response: the fixture that GET /v1/evaluate/sample returns for ?scenario=bot (no key needed), a fake browser driven by a script on a clean-looking address, trimmed to the fields that matter. It is test data for your handler, not a measurement of MASQ.
// example response, POST /v1/evaluate
{
"decision": "block",
"risk_score": 83,
"reasons": ["antidetect_browser", "automation_detected"],
"network": {
"vpn": false,
"proxy": false,
"datacenter": false,
"tor": false,
"residential": true,
"service": null
},
"device": {
"antidetect": true,
"automation": true,
"virtual_machine": false,
"tampering_score": 0.78
}
}
Either finding alone would block. residential is true only because no proxy or cloud-server flag fired; it does not prove a home connection.
Shipping it
Add the Maskbreak browser snippet to your signup, login and checkout forms. Your server forwards the two tokens the snippet collects to POST /v1/evaluate with your API key and gets allow, review or block back, with the reasons; the device and network blocks carry everything above. Start in watch mode: log each decision and let every visitor through, then enforce once the Events log looks right. Field-by-field docs live in the API reference and the quickstart has the handler.
If some of your own customers run fake browsers for agency or seller work, set the Fake browser (antidetect) rule to review on the console's Rules tab. A rule changes the answer only for the signal it names, so a proxy or a script on the same visit still blocks; when a rule does change the answer, engine_decision keeps the default. The antidetect hub explains how the detection works and compares the other browsers; the bonus abuse and multi-accounting playbooks cover the jobs MASQ's own use-case list points at.
Free plan: 10,000 visitor checks a month, no card. Paid plans from €29 a month.